agent-bom

AI supply-chain BOM: every agent, MCP server and AI package, and what each one can reach.

For AppSec teams and developers who run Claude Code, Cursor, Codex or any MCP client: see which agents, MCP servers, tools and packages are installed, which are vulnerable, and what each one can reach. Local scans need no account.

Quick start · Try in browser · Laptop → team → org · What you get · Product tour · Docs

Quick start

From the repository you want to inspect, with uv installed:

uvx agent-bom scan . --no-discover -f html -o agent-bom-report.html

Open agent-bom-report.html for inventory, findings and fix guidance. Run the same scan again later and agent-bom prints what changed since the last one. No MCP configuration in the project? Package findings still apply. No project handy? Run uvx agent-bom scan --demo --offline for a bundled sample; Exit 1 is expected there because the sample trips the security gate. A non-zero exit can mean a security gate or incomplete assessment; inspect the report and coverage (exit codes, what a scan does and does not establish, first-run guide).

From laptop to team to org

Why an AI supply-chain BOM

Agents and MCP servers ship without an inventory. A CVE in an AI package, a poisoned tool description or an over-scoped credential matters by what the agent that loads it can reach. A package SBOM stops at packages; agent-bom records the chain and keeps the evidence for every edge.

Fictional sample estate. Dashed use, credential and access links are configured or modeled, not observed at runtime; path analysis covers the collected snapshot only. The AWS badge describes environment membership; these sample agents have no recorded execution host or model endpoint. Agent, hosting and model context.

Findings map to OWASP LLM Top 10, OWASP Agentic Top 10, OWASP MCP Top 10, MITRE ATLAS, EU AI Act and NIST AI RMF; control mappings are investigation context, not certification.

What you get

Start with the workflow you need. An individual developer can scan, inspect findings and verify fixes without a shared control plane or a compliance workflow. Teams can add retained scans and shared inventory; organizations can add identity, audit review and governance when needed. These are adoption paths, not separate editions or permissions. See the deployment chooser.

What it covers

Generate a BOM from a project, or inspect an agent inventory with sample data:

agent-bom scan --project . -f cyclonedx -o sbom.cdx.json
agent-bom scan --project . -f spdx -o sbom.spdx.json
agent-bom scan --demo --offline -f json -o agent-bom.json

Model metadata appears when the source supplies it. A BOM is an inventory, not proof of safe execution or complete collection.

Investigate context and exposure

Which agent uses the vulnerable component? What could it reach? What evidence supports that path? Correlate retained scans by exact, tenant-scoped identities and trace the recorded blast radius from each agent through its MCP servers to packages, findings, credentials and data stores. Each relationship keeps its source and evidence kind. Agent kind, platform, execution host and model links are separate facts: an environment badge does not say where an agent runs.

From agent to verified fix: select Document Intake Agent → inspect CVE-2023-4863 (high, KEV-listed) and the evidence on each arrow → take the proposed remediation → rescan the changed pin and compare snapshots. The comparison verifies the changed input, not a running deployment.

Am I affected by a new CVE? Match it against stored scans, including CVEs only NVD has published. You get affected assets with their patch target, possibly affected distro packages to verify, and the blast radius (walkthrough):

agent-bom db update                                   # refresh OSV, NVD, KEV and EPSS
agent-bom db advisory affected CVE-2026-109618        # most recent saved scan
agent-bom db advisory affected CVE-2026-109618 --report <scan-report.json> --format json   # a JSON report written by an earlier scan

From an MCP client, the read-only affected_assets tool (graph and full profiles) takes the same advisory_id. In CI, run uvx agent-bom db update before the GitHub Action step (its auto-update-db default only refreshes feeds that missed the daily freshness target). To explain a finding to your team, create an impact brief with affected assets, source receipts, evidence gaps and the next action.

Open the sample graph

Try the demo in your browser: a read-only copy of the UI on labelled sample data, with no install and no backend. Scans, settings and sign-in are turned off there. To open the same graph locally:

pip install 'agent-bom[ui]==0.113.2'
agent-bom quickstart --run --offline

Run the server command it prints, then open its graph URL. Offline quickstart skips package-CVE lookup, so zero CVEs is not a clean verdict; use the bundled demo for advisory-backed findings or populate the advisory database.

Self-host in your environment

Your infrastructure, identity, database, and audit boundary. Start a local pilot from a published release checkout:

git clone --depth 1 --branch v0.113.2 https://github.com/koda-ai-studio/agent-bom.git && cd agent-bom
AGENT_BOM_IMAGE_TAG=0.113.2 docker compose up -d

Open http://localhost:3000, then Connections or New Scan. The pilot binds to loopback and retains state in a Docker volume. For cloud accounts, add a scoped read-only connection, verify access, then start a scan. Before sharing access, move to the authenticated deployment.

• Scan with CLI or CI; export findings, SBOMs and reports.
• Centralize inventory, graph evidence, remediation and compliance in your own control plane.
• Enforce policy on selected live MCP tool calls through the proxy or gateway.

Docker pilot guide · Compose with PostgreSQL · Choose a deployment · Enterprise controls · Connect cloud accounts

Integrations

/plugin marketplace add koda-ai-studio/agent-bom
/plugin install agent-bom@agent-bom

Trust and evidence

Discovery uses read-only access by default. Explicit disk side-scans create temporary cloud resources. Missing evidence stays unavailable or partial; control mappings are not audit certification.

Measured matcher proof · Product boundaries · Permissions · Threat model · Release verification · Graph data model

Contributing and support

Start with the first PR guide or a good first issue. Ask in GitHub Discussions (or Discord), share feedback, or follow the maintainer path (review owners).

Contributing · Capabilities and roadmap · Support · Report an inaccurate finding · Apache-2.0

Source version: v0.113.2 · Latest release: v0.113.2 · Changelog